In Linux Mint, I know that I can use the last
terminal command to view when a user last logged into their machine.
In my job, however, I often work with employees who leave each day by simply pressing "Switch Users" rather than actually logging out of their profiles to close all their tasks out of memory. This has caused a few manifestations of memory leaks. Is there a way to parse precisely how an employee last logged into their workstation and thereby identify whether the employee last used the "Switch Users" option to get back to the login screen? As far as I can tell, last
simply tells me that the employee entered their password at the login screen, and not necessarily whether their environment was still loaded from before.
tl;dr: How can I tell whether a user has logged in after "Switch Users," rather than them actually logging out all the way?
Best Answer
The "w" (or who) command will show the currently logged in users. For example:
In this example user "test" was logged in, and I used switch user to log in as "doug" and run the "w" command.
If you just want the user names, you can use the "users" command which will just print the user names:
As for how they logged in, you could check for environmental variables such as SSH_CONNECTION, SSH_CLIENT, REMOTEHOST, DISPLAY, and SESSIONNAME to see.